This invention relates to automated banking machines. Specifically this invention relates to an automated banking machine configuration system and method that provides for the selective and secure activation and configuration of software components and operational parameters.
Automated banking machines are well known. A common type of automated banking machine used by consumers is an automated teller machine (xe2x80x9cATMxe2x80x9d). ATMs enable customers to carry out banking transactions. Common banking transactions that may be carried out with ATMs include the dispensing of cash, the receipt of deposits, the transfer of funds between accounts, the payment of bills and account balance inquiries. The types of banking transactions a customer can carry out are determined by capabilities of the particular banking machine and the programming of the institution operating the machine. Other types of automated banking machines may allow customers to charge against accounts or to transfer funds. Other types of automated banking machines may print or dispense items of value such as coupons, tickets, wagering slips, vouchers, checks, food stamps, money orders, scrip or travelers checks. For purposes of this disclosure an automated banking machine or automated transaction machine shall encompass any device which carries out transactions including transfers of value.
ATM platforms often have the ability to perform different types of transaction functions depending on the types of software applications that are installed on the machine. Thus one ATM machine may be operatively configured with software to perform only certain banking transactions such as cash dispensing,. while another ATM machine with the generally similar physical hardware can perform additional transactions such as bill payment by installing additional ATM software (and sometimes hardware) components.
ATMs often are manufactured with a limited set of pre-installed ATM software components with a standard set of default features. When additional features and capabilities for an existing ATM are desired, a service technician (xe2x80x9cservicerxe2x80x9d) may access a secure chest portion of the ATM or other area where a disk drive or other media reader is located, and install additional software components which provide the additional desired functionality for the ATM. Such additional software is often installed from one or more portable mediums such as floppy disks, CD-ROMs or a hard drive.
A problem with this approach is that it may be time consuming to install new software on ATMs. A further drawback for the provider of the software is that the entity installing the copies may not pay the license fees for all the copies installed.
Approaches to software protection are sometimes used for mass market software applications such as word processors and consumer operating systems. These systems allow the manufacturer to generate and distribute thousands of copies of the exact same CD-ROM image. Unless the user has one of the activation keys, the applications will not install. However, one major drawback of this software protection method is that each activation key will work with any of the thousands of copies of the CD-ROM. With the availability of inexpensive CD-ROM writers, unlimited pirated copies of such software can be created. As long as a single valid activation key is included with each pirated CD-ROM, all of the pirated copies are fully capable of being used to install the software. Although such unauthorized copying is illegal, it is nevertheless being done throughout the world for mass market consumer applications. Consequently there exists a need for a system and method of operationally adding the functions of software components to authorized ATMs that minimizes the opportunity for the additional software components to be operated on unauthorized ATMs.
It is an object of the exemplary form of the present invention to provide an automated banking machine that may be selectively configured.
It is a further object of the exemplary form of the present invention to provide an automated banking machine that may be selectively configured by a servicer in the field.
It is a further object of the exemplary form of the present invention to provide an automated banking machine that may be selectively configured only within the parameters of a license agreement.
It is a further object of the exemplary. form of the present invention to provide an automated banking machine that may be selectively configured in a manner which minimizes the opportunity for software components to be operated on additional unauthorized automated banking machines.
It is a further object of the exemplary form of the present invention to provide a system and method for configuring automated banking machines.
It is a further object of the exemplary form of the present invention to provide a system and method for selectively enabling a remote automated banking machine to be configured.
It is a further object of the exemplary form of the present invention to provide a system and method for selectively enabling a plurality of remote automated banking machines to be configured.
It is a further object of the exemplary form of the present invention to provide a system and method for selectively enabling only an authorized ATM to be configured in a manner that is consistent with an authorized set of parameters.
Further objects of the exemplary form of the present invention will be made apparent in the following Best Modes for Carrying Out Invention and the appended claims.
The foregoing objects are accomplished in an exemplary embodiment of the invention by an automated banking machine that includes output devices such as a display screen, and input devices such as a touch screen and/or a keyboard. The banking machine further includes transaction function devices such as a dispenser mechanism for sheets of currency, a printer mechanism, a card reader/writer, a depository mechanism and other transaction function devices that are used by the machine in carrying out banking transactions.
The banking machine is in operative connection with at least one computer. The computer is in operative connection with the output devices and the input devices, as well as with the sheet dispenser mechanism, card reader and other physical transaction function devices in the banking machine. The computer includes at least one software application that is executable therein. The software application includes a plurality of different software components that may be selectively configured on the machine. The software components provide the computer with the programming necessary to carry out a plurality of different transaction functions with the machine. Based on the desired functionality for the machine, one or more of the software components may be selectively configured on the ATM. As used herein, the term xe2x80x9cconfigurexe2x80x9d encompasses the processes associated with either or both of configuring so as to enable carrying out desired functions and installing so as to enable instructions to be available for use by a computer device.
Configuration of software components is enabled to be performed responsive to a set of configuration rules. The configuration rules define which of the software components and associated features and parameters may be installed or modified by a servicer of the machine. The rules may enable a limited subset of components to be configured. The rules may also enable a complete set of software components to be configured on the machine. The rules may further specify individual parameters for the configuration of the software.
In one exemplary embodiment, authorization keys associated with the machine and the configuration rules must be input by a user before the software components are enabled to be configured on a machine. In a further exemplary embodiment, a digitally signed configuration certificate must be loaded on the machine before the software components are enabled to be configured. In this exemplary embodiment the configuration rules are included in or with the digitally signed configuration certificate and the software enables the machine to be configured responsive to the configuration rules in the certificate. In a further alternative exemplary embodiment the configuration rules are retrieved by the machine from a remote database. In a further alternative embodiment the configuration rules are retrieved from a remote authorization server application in operative connection with the computer. In another exemplary embodiment the configuration rules are configured responsive to encrypted data on a physical medium such as a magnetic stripe card or a smart card. In another exemplary embodiment the configuration rules are remotely set in the machine by a remote application accessing the machine across a network.
In an exemplary embodiment, the configuration rules are securely associated with one or more specifically authorized automated banking machines in such a manner that configuration rules for one machine cannot be used for an unauthorized machine. The configuration rules may be managed by a licensing authority such as the manufacturer of the automated banking machine or any other entity charged with managing the license provisions of automated banking machine software. When a customer wishes to add additional functionality to one or more machines, the licensing authority is contacted to acquire authorization to configure existing or additional software components on the machine. In response to this communication, the licensing authority is operative to selectively enable individual machines to be configured according to an updated set of configuration rules for the machine.
These new rules may be loaded onto an authorized automated banking machine as previously described from an authorization key, digitally signed configuration certificate, and/or smart card. In other exemplary embodiments this may also be accomplished by the licensing authority configuring a database or application server with updated configuration rules correlated to specific automated banking machines. In this described exemplary embodiment, each automated banking machine is operative to contact the database or application server through a network to determine which software components are authorized to be installed and configured.
In these described exemplary embodiments, a manufacturer of automated banking machines may pre-load each machine with a complete set of software components. The software components may be loaded as part of an installed software application or may be loaded in the form of one or more setup programs which can be installed and configured as fully operative components at a later time. Although a full set of software components may be pre-loaded, the risk that certain components will be used and configured in violation of a software license will be minimized due to the security encompassed by the described authorization methods and configuration rules of the present invention.
In one exemplary embodiment, the complete set of software components is pre-loaded on a non-volatile storage medium of the machine such as a hard drive. When additional components are properly authorized as discussed previously, the components may be configured on the machine from the pre-loaded software on the hard drive. In alternative exemplary embodiments the complete set of software components may be stored on one or more portable storage mediums such as CD-ROMs.
In an exemplary embodiment of the present invention, the authorization keys or certificates include machine or customer specific information. When the configuration or installation routines are initiated, the machine or customer specific information is compared to specific attributes associated with the machine. In one exemplary embodiment the automated banking machine includes a unique physical code built into a hardware component such as the ID found in Intel Pentium III CPUs or the MAC address found in network interface cards. In another exemplary embodiment the machine may have a software based unique code such as a Terminal ID associated with the machine itself, a customer number associated with the owner of the machine, or a network ID associated with the network address of the machine.
In this described exemplary embodiment, the machine will only enable the configuration of additional software components if the machine specific information embedded in an input certificate or authorization key corresponds to the unique hardware and/or software identification information associated with the machine. In addition the machine is operative to disable the newly configured or installed software components if a user attempts to change the unique identification information on the machine to values which are inconsistent with the certificate or authorization key. These features are operative to minimize an unscrupulous user from installing the software on unauthorized machines through changes to the unique machine specific information associated with the machine.
In other exemplary embodiments, the configuration rules may be associated with at least one expiration parameter. As a result, the automated banking machine will only permit configurations and installations to take place prior to the expiration of the configuration rules. Once the rules expire, the machine will continue to operate with its current configuration of software components. However, a servicer of the machine will be unable to add additional software components and/or configure existing software components unless the machine receives additional authorization. The additional authorization may be acquired as previously discussed by contacting the licensing authority to receive an updated set of authorization keys and/or configuration rules.
In exemplary embodiments the expiration parameter may be based on a fixed date such as Dec. 31, 2005 or may be based on a relative time period such as 30 days from the first configuration/installation of the software. Also the expiration parameter may be based on other non-time based information, such as a fixed or relative number of transactions the automated banking machine performs. In a further exemplary embodiment the expiration may be triggered by the machine receiving an expiration command message from a remote server.
In one exemplary embodiment, an authorization key includes a series of alphanumeric characters. The number of these characters is in a range that is practical for a servicer to manually type into a keyboard or keypad in operative connection with an automated banking machine. The authorization keys are generated by the licensing authority using an authorization algorithm. In one exemplary embodiment the key is derived from an authorization algorithm that accepts data that is associated with the specific machine and/or the owner of the machine. In this way the generated keys are only operative to activate software for the specific owner and/or machine.
This data may include for example, a MAC address, a Terminal ID, Gateway Router ID, TCP/IP address, Computer Name, Processor ID, a Network ID, DES keys, Poll ID, Primary Phone Number, Customer Name, Customer Number, Order Number, Serial Number and/or any other unique information that is available to both the machine in the field and a licensing authority. The algorithm may also accept additional information such as the version number of the software components, an expiration parameter and/or configuration rules.
The authorization algorithm is also accessible by the configuration/installation software on the machine in a form that cannot be easily derivable by the end user. In one exemplary embodiment the authorization algorithm may be embedded in the compiled machine code of the configuration/installation software. In other embodiments the authorization algorithm may be stored in an encrypted form on the machine.
In this described exemplary embodiment, the algorithm combines the input data along with a plurality of secret data only accessible to the algorithm. The algorithm then passes the combined data through one or more one-way hash functions to produce a unique number from the combined data. The exemplary one-way hash functions are non-reversible and produce unique numbers which cannot be used to re-derive the original data. In addition, small changes to individual characters in the original data produce dramatic changes in the unique number. Examples of operative one-way hash functions for use with the present invention include MD5 and SHA algorithms.
The resulting unique number or a truncated and/or encrypted form of the unique number may then be used as an authorization key for automated banking machine software. This unique number may also be combined with additional data to form the authorization key. For example the resulting authorization key may be of the form xe2x80x9cUJIE56IOP7H345B4-456789.xe2x80x9d Here the first portion before the hyphen (xe2x80x9cUJIE56IOP7H345B4xe2x80x9d) may correspond to the generated unique number, while the second portion after the hyphen (xe2x80x9c456789xe2x80x9d) may represent one or more of the original values used to generate the unique number such as a Terminal ID, a Customer ID, an Order ID, an expiration parameter, or a numeric representation of the configuration rules.
Prior to enabling software to be configured and/or installed, the software is operative to present the user with a screen which prompts the user to enter the authorization key. If the key was derived from an additional machine or customer specific data that has not been included as a portion of the authorization key (such as the previously described second portion of the authorization key), the software will prompt the user to enter this information as well. If the key is derived from fixed hardware embedded information such as a MAC address or processor ID, the software may retrieve this information from the hardware directly rather than prompting the user for the information.
Once machine and/or customer specific information has been gathered, the software is operative to calculate a unique number using the previously described authorization algorithm and the gathered data. The resulting number may then be compared to the authorization key entered by the user. If the calculated number corresponds to the input authorization key, the software enables the user to configure the software components. If the calculated number does not correspond to the input authorization key, the software will not enable the user to configure the software components. In addition, if the authorization key was derived from data representative of configuration rules, the software is operative to proceed with the configuration responsive to the configuration rules.
As discussed previously, a digitally signed certificate may also be used to securely authorize a specific configuration for an automated banking machine. The certificate may include information that specifies the configuration rules for a plurality of automated banking machines. This certificate may then be digitally signed by the licensing authority using a private key according to a cryptographic electronic signature process.
The certificate may then be installed locally on each automated banking machine, or may be loaded on a server in operative connection with one or more banking machines. The configuration software is operative to authenticate the digital signature and certificate by using a public key associated with the licensing authority. In the exemplary embodiment, the public key of the licensing authority is embedded in the software in a form that cannot be easily modified by a user. If the certificate is authenticated, the software enables the configuration of the software components on the machine to continue responsive to the configuration rules of the certificate. If the certificate is not authenticated, the software is not enabled to continue with the configuration of the machine. If the certificate includes configuration rules for a plurality of automated banking machines, the software is operative to configure the machine responsive to only that set of configuration rules that corresponds to the machine.
To correlate each machine to the proper set of configuration rules, each set of configuration rules in a certificate may include a unique machine specific hardware or software identification value. If the software cannot find a set of configuration rules in a certificate that corresponds to the machine being configured, the software will not enable the configuration of the machine to continue. After a machine has been configured, if a user attempts to change the unique machine specific hardware or software identification values on the machine itself, the software may be operative to either prevent the values from being modified or to disable the machine until the values are either changed back or a new certificate is loaded which includes authorized configuration rules for the corresponding changed values.
In an exemplary embodiment, newly manufactured automated banking machines may include an authorization certificate that corresponds to the license agreement associated with the purchase of the machines. If the terms of the license agreement are modified at a later time, a new certificate may be generated which corresponds to the new or updated license agreement. This new certificate may then be loaded on the machines or placed on a server which can be accessed by one or more machines through a network. The automated banking machine may then be re-configured according to the new certificate and the configuration rules associated therewith. In the exemplary embodiment the certificate also includes expiration parameters as previously described. After a certificate expires, the machines will continue to operate, however changes to portions of their configuration will not be permitted until an updated certificate is acquired from the licensing authority.